Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/execution-mode-reconciler.ts

@@ -27,9 +27,9 @@ const REVIEW_WAIT_STATE_TYPES = new Set(["user_reply", "user_review", "user_appr
 
 function collectImpactedAgentIdsFromWaitStates(db: AppDatabase, companyId: string): Set<string> {
   const agentIds = new Set<string>();
-  const waitStates = db.listThreadWaitStates(companyId);
+  const waitStates = db.threads.listThreadWaitStates(companyId);
   for (const waitState of waitStates) {
-    const thread = db.getThread(waitState.threadId, companyId);
+    const thread = db.threads.getThread(waitState.threadId, companyId);
     if (!thread || thread.relatedEntityType !== "task" || !thread.relatedEntityId) continue;
     try {
       const task = db.entityCrud.getTask(thread.relatedEntityId);
@@ -143,10 +143,10 @@ export function reconcileExecutionModeChange({
       });
     }
 
-    const waitStates = db.listThreadWaitStates(companyId);
+    const waitStates = db.threads.listThreadWaitStates(companyId);
     for (const waitState of waitStates) {
       if (!REVIEW_WAIT_STATE_TYPES.has(waitState.waitingFor)) continue;
-      db.resolveThreadWaitState(waitState.id, companyId);
+      db.threads.resolveThreadWaitState(waitState.id, companyId);
     }
   }